Checking structure sizes before reading them from memory to avoid overflowing the buffer's stream.

src/core/SkRRect.cpp

 /*
  * Copyright 2012 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkRRect.h"
 
 ///////////////////////////////////////////////////////////////////////////////
@@ skipping 241 matching lines @@
         }
         if (radii[i].fY) {
             radii[i].fY -= dy;
         }
     }
     dst->setRectRadii(r, radii);
 }
 
 ///////////////////////////////////////////////////////////////////////////////
 
-uint32_t SkRRect::writeToMemory(void* buffer) const {
+size_t SkRRect::writeToMemory(void* buffer) const {
     SkASSERT(kSizeInMemory == sizeof(SkRect) + sizeof(fRadii));
 
     memcpy(buffer, &fRect, sizeof(SkRect));
     memcpy((char*)buffer + sizeof(SkRect), fRadii, sizeof(fRadii));
     return kSizeInMemory;
 }
 
-uint32_t SkRRect::readFromMemory(const void* buffer) {
+size_t SkRRect::readFromMemory(const void* buffer, size_t length) {
+    if (length < kSizeInMemory) {
+        return 0;
+    }
+
     SkScalar storage[12];
     SkASSERT(sizeof(storage) == kSizeInMemory);
 
     // we make a local copy, to ensure alignment before we cast
     memcpy(storage, buffer, kSizeInMemory);
 
     this->setRectRadii(*(const SkRect*)&storage[0],
                        (const SkVector*)&storage[4]);
     return kSizeInMemory;
 }
@@ skipping 50 matching lines @@
             SkASSERT(!allRadiiZero && !allRadiiSame && !allCornersSquare);
             break;
         case kUnknown_Type:
             // no limits on this
             break;
     }
 }
 #endif // SK_DEBUG
 
 ///////////////////////////////////////////////////////////////////////////////